CVE-2023-34330 HIGH

CVE-2023-34330: Code injection via Dynamic Redfish Extension interface

Vendor Ami
Product MegaRAC_SPx12
Weakness CWE-94 · Code injection
Published July 18, 2023
Last update February 13, 2025
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.

Key dates

02Disclosure timeline

July 18, 2023 CVE published
February 13, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-25142 SandboxJS Prototype Pollution -> Sandbox Escape -> RCE CVE-2026-3409 eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection CVE-2024-10261 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form CVE-2026-40967